43 lines
1.2 KiB
Bash
43 lines
1.2 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
DENYLIST="/etc/edge/asn-denylist.txt"
|
|
ALLOWLIST="/etc/edge/asn-allowlist-v4.txt"
|
|
TMP="/tmp/asn_prefixes_v4.txt"
|
|
SETDENY="inet filter asn_deny_v4"
|
|
SETALLOW="inet filter asn_allow_v4"
|
|
TTL="7d"
|
|
|
|
command -v nft >/dev/null
|
|
command -v curl >/dev/null
|
|
command -v jq >/dev/null
|
|
|
|
mkdir -p /etc/edge
|
|
: > "$TMP"
|
|
|
|
# Allowlist (static)
|
|
if [[ -f "$ALLOWLIST" ]]; then
|
|
nft "flush set $SETALLOW" || true
|
|
while read -r cidr; do
|
|
[[ -z "${cidr}" || "${cidr:0:1}" == "#" ]] && continue
|
|
nft "add element $SETALLOW { $cidr }" || true
|
|
done < "$ALLOWLIST"
|
|
fi
|
|
|
|
# RIPEstat: announced prefixes for an ASN
|
|
while read -r asn; do
|
|
[[ -z "${asn}" || "${asn:0:1}" == "#" ]] && continue
|
|
asn="${asn#AS}"
|
|
|
|
url="https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS${asn}"
|
|
curl -fsS "$url" | jq -r '.data.prefixes[]?.prefix' | awk -F/ '$1 ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/ {print $0}' >> "$TMP"
|
|
done < "$DENYLIST"
|
|
|
|
sort -u -o "$TMP" "$TMP"
|
|
|
|
# Refresh TTL by re-adding elements
|
|
while read -r cidr; do
|
|
nft "add element $SETDENY { $cidr timeout $TTL }" || true
|
|
done < "$TMP"
|
|
|
|
echo "ASN deny refreshed: $(wc -l < "$TMP") IPv4 prefixes (TTL=$TTL)"
|